That was even mandated for all password fields by the PCI scans required for any sites accepting credit cards.